Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
18/01/2024, 16:18
Behavioral task
behavioral1
Sample
657a748c87d1cabb04a6354023b0754e.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
657a748c87d1cabb04a6354023b0754e.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
- Target 657a748c87d1cabb04a6354023b0754e.exe
- Size 138KB
- Sample240118-tsbqlsdgd6
- SHA256 44fd0d51c6be55932888d801a5a1f520018973e8207cdb56f5db198d8b69bdb5
- MD5 657a748c87d1cabb04a6354023b0754e
- SHA1 3c815136972652137107ba1e741633bcc291ac94
- SHA512 2ad3a537f565a173c5b4cc166eb3a8e4b47c5ca79703362f1484e89c0ec8a8ab7a4e7db3a0302d0733ef2eb3135897eb4e4ca983e63c463352a28f70d137b36a
- SSDEEP 3072:hgkkaayaRjUYxV2wbJ5Bd234AIEa/Rougr:2lyapUYxV2w0qEIs
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0007000000023217-2.dat aspack_v212_v242 behavioral2/files/0x0007000000023217-1.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2076 winhelp.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created \??\c:\windows\help\winhelp.exe 657a748c87d1cabb04a6354023b0754e.exe File opened for modification \??\c:\windows\help\winhelp.exe 657a748c87d1cabb04a6354023b0754e.exe File created \??\c:\windows\help\winhelp.exe winhelp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\657a748c87d1cabb04a6354023b0754e.exe"C:\Users\Admin\AppData\Local\Temp\657a748c87d1cabb04a6354023b0754e.exe"1⤵
- Drops file in Windows directory
PID:1584
-
\??\c:\windows\help\winhelp.exec:\windows\help\winhelp.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2076
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Help\winhelp.exe
- Size 32KB
- SHA256 d674aa30310ca720d4cb70bfed0de826ff4106914a170dbfc93934c192f72369
- MD5 d915f0b0a5a9eba1b2af2aaf2a906a77
- SHA1 ffec085c661717f607a687fe37684f2874f3c056
- SHA512 bd97b155f2423fc71f1145b7ae3e3dc8cdecbb2e276cc54b71af3c8142163c53c67dabcb3ddff6075819de7af526103d6f2a6a4dd75fe88d92d60a0f13b7ce5e
- SSDEEP 768:HR7YtMI+c/Pe+/wvDx5KcXxe2tfHFXuXDIFofKe7Vy6:hYtMKd/u57fHVuXDIqKay6
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\help\winhelp.exe
- Size 84KB
- SHA256 d9c2419ce416dff4880252a39bba63aa52ff25fa229fcc8aedbb31f26ef81b41
- MD5 b640c805c43c3639d8c14965ae9e9e5d
- SHA1 7a02142494c3fa4d03c822e6d24377a9f36449bc
- SHA512 e6d67e7ebea8866e820d2c1137c4c29cd52064f25656db82c0af7c76973e6b20a0a0721a8a07f53e6f54221fb117e86f572b9da478356b3fbec8a2b3c8b8e1e8
- SSDEEP 1536:hYtMKd/u57fHVuXDIqKay6mGLB3IQfk8KtSpw+V24hnnp6eJ5gDCr2krTWn86:hgkkaayaRjUYxV2wbJ5Bd2N
- MD5 SHA1 SHA512 SSDEEP